Since Tetration has visibility both inside the endpoint and the traffic flowing through the network, it gives us some amazing forensic analysis capabilities. In this post, we will review some of these powerful capabilities but this is far from all of the forensic features in Tetration.

Before making any policy changes, one usually would want to be able to analyze how it would impact traffic. Tetration has the ability to simulate and validate policy before applying changes using its Policy Analysis feature.

One of the awesome things that Tetration can do is create dynamic policies based on changing conditions and detect vulnerable software in workloads. In this blog post, I will briefly go over both of these features.

We previously went into application mapping in this blog post and we will delve into it further in this post to explain how that application mapping is used to create whitelists that can be used for micro-segmentation.

I took some time to import and update quite a bit of RADIUS vendor dictionaries for 3rd party vendors into ISE. I grabbed this information from various community and open source sites but I obviously can't test it against every vendor out there since I don't have a selection of 140+ 3rd party NADs sitting in my lab. After I imported them to ISE, I exported them and have uploaded them here.

Before I begin, I’d just like to thank my friend JP Cedeno for giving me a crash course into Tetration and allowing me to use what he taught me to make the next few blog posts. I’d also like to dedicate this blog post to Matt White who asked for it some months ago. In this blog post, we’re going to go over the fundamentals of Tetration.

I finally passed the CCIE Security this week after starting this journey over 2 years ago in November of 2015. As I did with the CCIE Data Center, I'm going to go through the cost and time I spent on the CCIE Security.

I wanted to write this post on how to save a little time by using template access lists to copy and paste your ACLs into the command line of the wireless controller. In this small blog post, I'll share a couple templates for Blackhole, Employee, Guest and Web Redirect ACLs which anyone could use.

In this blog post, I'm going to go over a different way to configure your switch for ISE called Cisco Common Classification Policy Language (C3PL). I have known about this configuration for awhile but I will admit that I didn't really try to learn it until recent. If you read the IBNS 2.0 deployment guide here, it's pretty intimidating guide at a whopping 65 pages long and reads like a typical manual. I ended up reading Jamey Heary and Aaron Woland's Cisco ISE for BYOD Second Edition and they broke it down beautifully in 4 pages which made me go "Team C3PL."

In this blog post, I'm going to get into designing, scaling and deploying ISE. Like any piece of infrastructure, all the best configurations in the world won't help you if it's not design properly. In this post, I'm going to really focus on what I do to make an ISE implementation successful.

In this long overdue post, I'm going to go over my recently favorite release of ISE: ISE 2.3. I planned to write this a month or two ago but got a bit busy with work and other stuff so I'm catching up a little now.

In this blog post, I'm going to go over the new policy sets in ISE 2.3. A lot of people have come to me and said they were worried about having to learn the new policy sets. Well, I have good news for you: While there are some enhancements, it's not really as initimating or new as you think. Are there enhancements? Sure! But it doesn't mean you have to re-learn the whole thing if you don't want to.

In this post, I'm going to review the PassiveID features of ISE that are new as of ISE 2.2 and 2.3. In this particular post, I'll be doing it all from ISE 2.3 but bear in mind that you can do all this from ISE 2.3 as well. In ISE 2.0, there was a feature added called EasyConnect which utilized WMI logs from the Active Directory Domain Controller to check for login events. Based on those login events, ISE would make a decision to grant access. This allowed ISE to grant network access beyond the typical 802.1x and profiling methods. This functioned well but required a LOT of backend work to prepare Active Directory to share the WMI logs and if you read my earlier post here, you will see what I mean The creators of ISE decided to revamp this process and create a better way to do this in ISE 2.2 and later.

It's been awhile since I've written on my blog and I wanted to update you all with a review of some of the training material I'm going through. A few months ago, I saw an ad for a trainer called Khawar Butt who was selling an "All Access Pass" for his CCIE training. This post is going to be about my decision to give it a try and my experience with his courses.

In this post, I'll be configuring site-to-site VPN with ASA as peers. This post won't be a very long one because the configuration is almost identical to configuring it on a router using crypto maps with some slight syntax changes.

In this post, we are going to go over troubleshooting our VPN using debug commands. This is particularly useful for the folks out there reading this that only have access to only one side of the VPN or have a VPN to a 3rd party. I wanted this to remain a separate post from my ASA and IOS site-to-site VPN configuration posts because troubleshooting this is almost entirely identity on both a router or an ASA so I wanted to combine the troubleshooting to a single post.

In this post, I'm going to go through configuring site-to-site VPN on IOS. We're going to take what we learned in the last blog post and apply it here. I think the best way this was explained to me was by Khawar Butt where you should think about your VPN configuration by break it down by the phases and then create your base VPN configuration on that. For the folks who don't know who Khawar Butt is, I'll be writing a review of his class shortly but you can see a sample of his work here.